Arista Patches Maximum-Severity VeloCloud Orchestrator Zero-Day as Attackers Exploit It in the Wild

Overview

Arista Networks has patched a maximum-severity vulnerability in its VeloCloud Orchestrator (VCO) software after confirming attackers were already exploiting it in the wild, according to Arista’s security advisory. The flaw, tracked as CVE-2026-16812, may allow a remote attacker to reach privileged internal functionality on the orchestrator host and compromise its confidentiality, integrity, and availability, according to the advisory.

What We Know

• The vulnerability carries a CVSS 3.1 base score of 10.0 — the maximum possible — with a CWE-78 classification for OS command injection, according to the National Vulnerability Database.
• Arista’s advisory states the flaw “may allow a remote attacker to access privileged internal functionality and impact the VCO host,” and that “successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator,” according to Arista.
• Arista confirmed the issue “was discovered externally and is known to be actively exploited,” according to the company’s advisory.
• Exploitation requires only network access to the VCO web interface, with no credentials necessary, according to BleepingComputer, which described VeloCloud Orchestrator as “a centralized management platform for configuring and monitoring SD-WAN deployments and edge devices.”
• The vulnerability affects only on-premises VCO deployments running 5.2.x releases before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4, and 7.0.x before 7.0.0.1, according to Arista’s advisory. Hosted and Dedicated VCO deployments were already patched beforehand, and VeloCloud Gateway and Edge products are not affected, according to BleepingComputer.
• Arista has identified three IP addresses — 8.19.75.217, 206.72.242.124, and 206.72.242.162 — observed exploiting the vulnerability, according to the advisory.
• The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to apply the fix by July 30, 2026, according to The Hacker News and BleepingComputer.
• Until patches are applied, Arista recommends administrators “restrict access to the VCO web interface to trusted administrative networks” and monitor logs for unusual URL paths and unexpected outbound connections, according to the advisory.

What We Don’t Know

• Arista has not disclosed when the attacks began or where they originated, according to BleepingComputer.
• The company has not named who found the flaw; its advisory states only that it “was discovered externally,” according to Arista.
• No threat actor or campaign has been publicly attributed to the exploitation activity in any of the available reporting.